GHSA-6mww-xvh7-fq4f

Koji hub call does not perform correct access checks

Source: GitHub Advisory Database (reviewed) Critical CVE-2018-1002150

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	koji	>= 1.15, < 1.15.1	1.15.1
PyPI	koji	>= 1.14, < 1.14.1	1.14.1
PyPI	koji	>= 1.13, < 1.13.1	1.13.1
PyPI	koji	>= 1.12, < 1.12.1	1.12.1

Details

As written in the advisory (Markdown source, shown as plain text).

Koji version 1.12, 1.13, 1.14 and 1.15 contain an incorrect access control vulnerability resulting in arbitrary filesystem read/write access. This vulnerability has been fixed in versions 1.12.1, 1.13.1, 1.14.1 and 1.15.1.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2018-1002150 advisory
https://docs.pagure.org/koji/CVE-2018-1002150 web
https://github.com/advisories/GHSA-6mww-xvh7-fq4f advisory
https://github.com/pypa/advisory-database/tree/main/vulns/koji/PYSEC-2018-86.yaml web
https://pagure.io/koji package
https://pagure.io/koji/c/ab1ade7 web
https://pagure.io/koji/issue/850 web